K08441753 : Multiple Intel Ethernet 700 Series Controllers vulnerabilities

Security Advisory Description

• CVE-2019-0139

Insufficient access control in firmware for Intel® Ethernet 700 Series Controllers before version 7.0 may allow a privileged user to potentially enable an escalation of privilege, denial of service, or information disclosure via local access.

• CVE-2019-0140

Buffer overflow in firmware for Intel® Ethernet 700 Series Controllers before version 7.0 may allow an unauthenticated user to potentially enable an escalation of privilege via an adjacent access.

• CVE-2019-0142

Insufficient access control in ilp60x64.sys driver for Intel® Ethernet 700 Series Controllers before version 1.33.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.

• CVE-2019-0143

Unhandled exception in Kernel-mode drivers for Intel® Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0144

Unhandled exception in firmware for Intel® Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0145

Buffer overflow in i40e driver for Intel® Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.

• CVE-2019-0146

Resource leak in i40e driver for Intel® Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0147

Insufficient input validation in i40e driver for Intel® Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0148

Resource leak in i40e driver for Intel® Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0149

Insufficient input validation in i40e driver for Intel® Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.

• CVE-2019-0150

Insufficient access control in firmware Intel® Ethernet 700 Series Controllers versions before 7.0 may allow a privileged user to potentially enable a denial of service via local access.

Impact

There is no impact; F5 products are not affected by this vulnerability.

However, in cloud and Virtual Edition (VE) environments, preventing these attacks falls on the hypervisor/host platform, outside the scope of F5’s ability to support or patch. Please contact your cloud provider or hypervisor vendor to ensure their platforms or products are not subject to this vulnerability.